Python Runtime Silently Installed into Disguised LOCALAPPDATA Directory

Ethan Andrews@eandrews

•updated Jun 25, 2026•1•0•3

Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.